The vulnerability resides in the chaiscript::Boxed_Number::get_as function within boxed_number.hpp. When a manipulated input is passed to this function, it causes uncontrolled memory corruption. This flaw can overwrite nearby memory, potentially leading to crashes or arbitrary code execution if a local attacker can influence the data processed by the function. The flaw is a classic out‑of‑bounds write (CWE-119) combined with a use‑after‑free or buffer overrun scenario (CWE-787). The impact is limited to the host process but may compromise confidentiality, integrity, or availability of the application executing the script.

All installations of ChaiScript up to and including version 6.1.0 are affected. The issue was identified in the ChaiScript code base, which is publicly available on GitHub. Users running any build of the library that includes the vulnerable get_as implementation are at risk, regardless of the specific application compiled with it.

The CVSS score of 4.8 indicates a moderate severity, but the EPSS score is less than 1%, reflecting a low likelihood of exploitation in the wild at present. The flaw is not listed in the CISA KEV catalog, and exploit code has been released publicly. Because the attack requires local access, an attacker who can execute code with the same privileges as the running process can exploit the memory corruption. Organizations should prioritize applying a fix or mitigation as soon as a patched version becomes available, as local privilege escalation via this flaw could have significant downstream effects on application stability and security.